Login Request a demo
High severity · published Jan 13, 2026
CVE-2026-0404
Insufficient input validation in NETGEAR Orbi routers
8.0
CVSS
1.1%
EPSS
No
On KEV
Description
An insufficient input validation vulnerability in NETGEAR Orbi devices' DHCPv6 functionality allows network adjacent attackers authenticated over WiFi or on LAN to execute OS command injections on the router. DHCPv6 is not enabled by default.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
RBR750 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBR840 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBR850 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBR860 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBRE950 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBRE960 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBS750 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBS840 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBS850 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBS860 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBSE950 · NETGEAR
before v7.2.8.5 · source: vendor
RB
RBSE960 · NETGEAR
before v7.2.8.5 · source: vendor
Affected product
RB
RBR750
NETGEAR
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0404
Patch
https://kb.netgear.com/000070442/January-2026-NETGEAR-Security-Advisory
Patch
https://www.netgear.com/support/product/rbr750
Patch
https://www.netgear.com/support/product/rbr840
Patch
https://www.netgear.com/support/product/rbr850
Patch
https://www.netgear.com/support/product/rbr860
Patch
https://www.netgear.com/support/product/rbre950
More from RBR750
8.0
CVE-2026-0403
Insufficient input validation in NETGEAR Orbi routers
7.8
CVE-2026-0405
Authentication Bypass in NETGEAR Orbi Devices
4.5
CVE-2026-0415
Insufficient input validation vulnerability in certain Orbi routers
4.5
CVE-2026-0413
Buffer overflow vulnerability in certain NETGEAR Nighthawk routers
4.5
CVE-2026-0418
Certain NETGEAR devices allow administrators to tamper with system